A transfer is subject to appropriate safeguards only where an appropriate legal instrument binds the recipient (one to which a competent authority is party and each such party reasonably and proportionately considers the data protection test met) or the controller, acting reasonably and proportionately in view of all the circumstances including the nature and volume of data, considers that after transfer protection would not be materially lower than under Part 3 and Parts 5 to 7. Except for transfers to processors, the controller must inform the Commissioner of the categories of transfers made on its own assessment, and document each transfer with its date and time, the recipient, the justification and a description of the data, giving the documentation to the Commissioner on request. The Commissioner's standard clauses under section 119A may be used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.